Could a contactless card reader steal money from my locked iPhone?

Researchers in the UK have demonstrated how hackers could steal money from your Visa card using Apple Pay Express Transit mode. This mode allows your card to be accessed without having to use Face ID or your passcode and is designed to allow users to effortlessly pass through transit gates, such as those on the London Underground and the New York City subway, which allow contactless pay via a credit card.

Apple Pay has been considered to be resilient to hackers, as it uses a token account number for purchases rather than your actual credit card number and requires your Face ID on an iPhone to pay, or a double tap on an Apple Watch. The Express Transit mode allows the iPhone to bypass this second phase of security by broadcasting a signal to the iPhone.

By replicating that signal, the researchers were able to obtain the card data to make payments on regular contactless card machines. They were also able to bypass the low payment limit set for contactless payment. However, this was only possible when a Visa card was tied to the Express Transit account – when a Mastercard was used, it didn’t work. It also didn't work when using a Visa card on a Samsung phone.

• Best cheap Apple TV sales, deals and prices for September 2021
• iPhone 13 review: a phone for everyone
• iPhone 13 Pro Max review: the ultimate iPhone

The research is summarized on a new website, which explains the findings of the test. It advises iPhone users to 'not use Visa as a transport card in Apple Pay.' It also states that 'if your iPhone is lost or stolen, activate the Lost Mode on your iPhone, and call your bank to block your card.'

There is good news though. Firstly, even if you have a Visa card on your Apple Pay, you need to manually activate the Express Transit mode for this to be possible – it’s turned off by default. The second is that this danger is theoretical and hasn’t been happening in the real world (as far as we know).

Also, now that this information is widely known, we can expect a solution to stop this happening – either from Visa or from Apple. And in the meantime, Visa offers zero-liability protection for any unauthorized payments.

How to turn off Express Transit mode

If you want to make sure your card can’t be accessed, on your iPhone, go to Settings>Wallet & Apple Pay and click on your Visa card. In the card information you will see an option for Express Transit. Click this and select None.